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DETAILED ACTION 

1. This office action is in reply to an amendment filed on February 28, 
2008. 

2. Claims 7 and 20 were canceled in the previous amendment. Thus claims 
1-6, 8-19 and 21-24 are pending/ examined. 

Response to Arguments 



3. Applicant's remarks /arguments filed on February 28, 

2008 have been fully considered but they are not persuasive. 
Applicant argument is specifically based on the limitation, "having a 
reporter to generate/generating an audit trail from the at least one 
aggregate event, the audit trail representing usage of the at least 
one digital asset by the end user" recited in independent claim 1 and 
17. Applicant's representative argued that, this limitation is not disclosed 
by the reference /son the record. 

In order to support his argument applicant wrote the following. 

"While the audit trails of Ginter represent the usage of the electronic 
property by the consumers, Ginter does not disclose that the audit trails 
are generated from "at least one aggregate event, "as claimed in 
independent Claims 1 and 1 7. As described in the Applicants' 
specification, an aggregate event is a particular type of event that 
corresponds to a certain predetermined sequence of atomic level events 
(see Applicants' specification, page 7, lines 14- 20). Ginter does refer to a 
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sort of aggregation, in that payments in the system of Ginter are 
aggregated, but the aggregation of payments is not equivalent to the 
aggregate events of the present application and, as such, Ginter discloses 
no such aggregate events. To interpret any aggregation in Ginter as 
disclosing the claimed "aggregate events" would be inconsistent with the 
Applicants' specification. Therefore, because Ginter discloses no such 
aggregate events, Ginter cannot generate an audit trail from such 
aggregate events. " 

Examiner disagrees with the above arguments. A close review of the 
secondary reference on the record, reveals that Ginter/ secondary 
reference on the record indeed discloses the above argued limitation. 
Examiner in particular would like to point out that Ginter on column 65, 
lines 4-34 discloses the following. 

"FIG. 35 shows an example overall usage clearing process. In this 
example, a provider 164 provides a digital property to consumers 95(1), 
95(2), 95(3). For example, provider 164 might provide a novel or other 
work 166 to each of the consumers 95 within electronic containers 152. 
One or more control sets 188 may be associated with the work 166 (and 
may, in one example, be delivered within the same electronic container 
152 used to deliver the work 166). The controls 188 may specify 
that certain types of usage information must be gathered in the 
form of an audit trail, and that the audit trail must be reported 
based on certain time and/ or other events . 
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Because container 152 can only be opened within a secure protected 
processing environment 1 54 that is part of the virtual distribution 
environment described in the above-referenced Ginter et al. patent 
disclosure, provider 164 can be confident that the required audit trails 
will be generated and reported as he or she instructs. As consumers 95 
use the property 166, their electronic appliances 100 automatically 
gather and store the usage information in the form of audit trails 302. 
Then, upon the occurrence of a specified event (e.g., once a month, once 
a week, after a certain number of uses, etc.), the consumer electronic 
appliances 100 send audit trail information 302 within digital containers 
to usage clearinghouse 300." 

Usage clearinghouse 300 collects the audit trail information 302, 
may store it in its database 316, and analyzes the audit trail 
information to generate a report 304 which it may send to provider 
164 within a further electronic container 152." 

As it disclosed above the usage information in Ginter is gathered in the 
form of an audit trial based on events and such events includes the 
occurrence of a certain number of uses of the digital 
property/ assets. 

In view of the above understanding and applicant's own specification 
which indicates the fact that system events are events such as read, 
write, copy and CD-RW access of digital assets, Examiner would point 
out that such events recited in the limitation are not different from usage 
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information which is gathered in the form of an audit trial based on 
events since such events includes the occurrence of a certain number of 
uses of the digital property/ assets. 

The next argument presented was related to the same limitation. 
Applicant's representative further argued that in Ginter, the reference on 
the record the generation of the audit trail does take place in a central 
location. 

In relation to above argument, applicant's representative wrote the 
following. 

"Moreover, even if Ginter did disclose the generation of an audit trail from 
aggregate events, the generation of the audit trail does not take place at a 
central location. In Ginter, the audit trails are generated at each of the 
consumers' locations, and sent to the usage clearinghouse. In contrast, the 
audit trail of the present application is generated at the journaling server 
(i.e., a central location) after the journaling server receives the atomic level 
events from the user client devices. Because Ginter does not disclose that 
the audit trails are generated from aggregate events and because the audit 
trails of Ginter are not generated at a central location (i.e., at a location 
equivalent to the journaling server of the claimed invention), Ginter does 
not disclose "ajoumaling server ... having a reporter to generate an audit 
trail from the at least one aggregate event, the audit trail representing 
usage of the at least one digital asset by the end user, " as claimed in 
Claim 1 and as similarly claimed in Claim 1 7. " 
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Examiner disagrees with the above arguments. A close review of the 
secondary reference on the record, namely Ginter reveals that such 
limitation is indeed disclosed by the cited reference /Ginter. 
Examiner in particular would like to point out that Ginter on column 65, 
lines 29-34 discloses the following. 

. . Usage clearinghouse 300 collects the audit trail information 302, may 
store it in its database 316, and analyzes the audit trail information to 
generate a report 304 which it may send to provider 1 64 within a 
further electronic container 1 52. " 

As it is indicated above, unlike the applicant's argument the audit trial is 
collected in the Clearinghouse which meets the limitation journaling 
server and it is this "Clearinghouse/journaling server which analyzes the 
audit trail information and generates the report 304. 

In response to the next applicant's argument referring to the lack of 
motivation/ s to combine the two reference/ s on the record namely 
Belfiore and Ginter, Examiner would like to point out that the examiner 
recognizes that obviousness can only be established by combining or 
modifying the teachings of the prior art to produce the claimed invention 
where there is some teaching, suggestion, or motivation to do so found 
either in the references themselves or in the knowledge generally 
available to one of ordinary skill in the art. See In re Fine, 837 
F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988)and In re Jones, 958 
F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 1992). In this case, the motivation 
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is explicitly indicated in the reference themselves. (See the motivation 

below) 

Finally, 

In response to applicant's argument referring to the dependent claims 
examiner would like to point out that the dependent claims stands and 
falls with the respective independent claims. 

Applicant's representative is encouraged to request a telephone interview 
to discuss how examiner interprets the limitation of the independent 
claims and how the independent claims could be amended to overcome 
the ground of rejection set forth in this office action and possible make 
the application allowable. 



Claim Rejections - 35 USC §103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 

all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically 
disclosed or described as set forth in section 102 of this title, if the 
differences between the subject matter sought to be patented and the 
prior art are such that the subject matter as a whole would have been 
obvious at the time the invention was made to a person having ordinary 
skill in the art to which said subject matter pertains. Patentability shall 
not be negatived by the manner in which the invention was made. 



4. 



Claims 1-6. 8-19 and 21-24 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Belfiore et al. (hereinafter referred as 
Belfiore)(U.S. Patent No. 6,990,513 B2) (filed on Jun 22, 2001) in view of 
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Ginter et al Title (hereinafter refereed as Ginter) (Patent No. 7,165,174 
Bl) (filed on December 17,1999) 

5. As per claims 1 and 16-17 and 23-24 Belfiore discloses a system for 
providing a usage accountability model for data security in a data 
processing system comprising: 

• A user device having a sensor for to sense or capture 
atomic level events at a point of authorized access to at least one 
digital assest by an end user client device; [column 20, lines 57-58, 
figure 5, ref. Num. "606" see "atomic events provided by event sources 
602"/ As shown on figure 5, ref. Num "606" the atomic events are 
captured) the sensor located within an operating system kernel 
within a user client device; Column 28, lines 1-6 and column 22, lines 
46-56] [For instance on column 28, lines 1-6 the following has been 
disclosed. "In one embodiment, the HTTP client is implemented in kernel 
mode. Reasons for implementation in kernel mode include 1) performance; 
2) communication with kernel components; and 3) listener/ talker 
integration. The benefits of listener/ talker integration include performance 
optimizations and shared implementation. " Furthermore on column 22, 
lines 46-56 the following has been disclosed. The event system includes a 
highly optimized publication and subscription service driven by model- 
based subscription registrations. The events system allows for flexibility 
and choice of the service to publish events, such as, by way of example, 
kernel events (e.g. WDM drivers events) that utilize a kernel driver 
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programming model, non-COM APIs for publishing events (e.g. security 
audit events, a directory, a service control manager) that utilize a low-level 
operating system service programming model, classic COM interfaces for 
normal applications, and high-level COM+ classes that utilize native COM+ 
programming model.) and 

• a journaling server having An aggregator, to accept or 
for accepting the atomic level events from the user client device 
and to generate an aggregate a t least some of the atomic level 
events to generate at least one aggregate based on a predetermined 
sequence of atomic level events, [column 21, lines 4-12 and column 20, 
lines 57-67] (Event composition 608 aggregates, filters, and transforms 
lower-level events (atomic events 606) which meets the limitation of 
"multiple atomic level events" into higher-level events 612, which meets 
the limitation of a journal/ aggregate event And, at times, maps the events 
directly into actions, such as world action 614. The actions include real- 
world actions 614 and information-gathering actions 616 that serve to 
gather new events via actively polling or listening. Event composition 
608 provides methods for combining events and data, whether the 
events are observed in close temporal proximity or at widely different 
times. On column 20, lines 57-67, the following has also been disclosed, 
"The event component 155 transforms fundamental or atomic 
events 606 provided by event sources 602 into progressively higher- 
level events/predetermined sequence of atomic level; through an 
event composition mechanism 608. The process of event composition is the 
construction of new events or actions from a set of observed events and/ or 
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stored event data. Event composition may be driven by rules, filters, and 
by more advanced pattern recognizers spanning a spectrum of 
sophistication all the way up to rich inferential machinery. Thus, event 
composition adapts the set of available atomic events 606 into 
observations 610 that are appropriately matched to the informational 
requirements of software components, providing them with information at 
the right level of abstraction to make good decisions.) 

Belfiore does not explicitly disclose, the following limitation added 
by the amendenent. 

"Having a reporter to generate an audit trail from the at least one 
aggregate event, the audit trail representing usage of the at least one 
digital asset by the end user" 



However, in the same field of endeavor, Ginter on column 65, lines 4- 

34 discloses the following which meets the above limitation. 

"FIG. 35 shows an example overall usage clearing process. In this 
example, a provider 164 provides a digital property to consumers 95(1), 
95(2), 95(3). For example, provider 164 might provide a novel or other work 
166 to each of the consumers 95 within electronic containers 152. One or 
more control sets 188 may be associated with the work 166 (and may, in 
one example, be delivered within the same electronic container 152 used to 
deliver the work 166). The controls 188 may specify that certain types of 
usage information must be gathered in the form o f an audit trail, and that 
the audit trail must be reported based on certain time and/ or other events . 

Because container 152 can only be opened within a secure protected 
processing environment 154 that is part of the virtual distribution 
environment described in the above-referenced Ginter et al. patent 
disclosure, provider 1 64 can be confident that the required audit trails will 
be generated and reported as he or she instructs. As consumers 95 use the 
property 166, their electronic appliances 100 automatically gather and 
store the usage information in the form of audit trails 302. Then, upon the 
occurrence of a specified event (e.g., once a month, once a week, after a 
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certain number of uses, etc.), the consumer electronic appliances 100 send 
audit trail information 302 within digital containers to usage clearinghouse 
300. 

Usage clearinghouse 300 collects the audit trail information 302, may store 
it in its database 316, and analyzes the audit trail information to 
generate a report 304 which it may send to provider 1 64 within a 
further electronic container 1 52. " 

It would have been obvious to one having ordinary skill in the art, 
at the time the invention was made, to combine the features such as 
"having a reporter to generate an audit trail from the at least one 
aggregate event, the audit trail representing usage of the at least one 
digital asset by the end user" as per teachings of Ginter into the method 
as taught by Belfiore for the purpose of building a data security model 
which includes usage information while at the same time aggregating 
and providing a high level of accountability. [See for instance, Ginter 
column 57, lines 9-11] 

6. As per claims 2-3 the combination of Belfiore and Ginter discloses a 
system/method as applied to claims above. Furthermore Belfiore 
discloses the method/system wherein, the aggregate events are 
associated with a particular executing process/ with a particular 
user, [column 34-45 and column 21, lines 4-12 and column 20, lines 57- 
67] [The event component 155 of the present invention transparently 
facilitates the distributed communication of events between any software 
component that publishes or generates events ("event source") and any 
software component that subscribes to or receives event notifications 
("event sink"). In this description and in the claims, an event is an 
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observation about one or more states such as, for example, the status of 
system components, the activity of a user.) 
7. As per claims 4 and 18 the combination of Belfiore and Ginter 

discloses a system/method as applied to claims above. Furthermore 
Belfiore discloses the method/ system wherein the user client device 
further includes: a filter for filtering atomic level events with an 
approved event list and wherein the aggregator only accepts atomic 
level events not filtered out by the filter. [Column 21, lines 4-19 and 
column 20, lines 62-column 21, lines 3 and column 22, lines 63-64] (Event 
composition 608 aggregates, filters, and transforms lower-level events 
(atomic events 606) into higher-level events 612 and, at times, maps the 
events directly into actions, such as world action 614. and on column lines 
it has been disclosed that Event composition may be driven by rules, 
filters, and by more advanced pattern recognizers spanning a spectrum of 
sophistication all the way up to rich inferential machinery. Thus, event 
composition adapts the set of available atomic events 606 into 
observations 610 that are appropriately matched to the informational 
requirements of software components/ such requirements meets the 
limitation of approved event list, providing them with information at 
the right level of abstraction to make good decisions.) 

8. As per claims 5-6 and 19 the combination of Belfiore and Ginter 

discloses a system/method as applied to claims above. Furthermore 
Belfiore discloses the method/ system wherein the approved event 
list includes a list of approved file identifiers/hash code. [Figure 5, ref. 
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Num. 610/612 and 622, column 21, lines 3-35] (As shown on figure 5, High 
level events shown as 612 which meets the limitation of approved event list 
is stored in event store as shown on figure 5, 622 inferences are performed. 
Such events should have some kinds of identifier when they are stored and 
hashing a value for the sake of utilizing the space requirement is something 
which is also included in storing the list of approved file identifiers /high 
level events 612) 

9. As per claims 8 and 21 the combination of Belfiore and Ginter 
discloses a system/method as applied to claims above. Furthermore 
Belfiore discloses the method/ system wherein the user client device 
includes: a coalescer to coalesce atomic multiple events output by the 
sensor into a single event prior to inputting them to the aggregator. 
[Figure 5, ref. Num "606"] 

10. As per claims 9-10 and 22 the combination of Belfiore and Ginter 
discloses a system/method as applied to claims above. Furthermore 
Belfiore discloses the method/ system wherein a bundle of coalesced 
events is created prior to their transmission between the user client 
device and the server. [Figure 5, ref. Num "608"/ event composition meets 
the limitation of a bundle of coalesced events] 

11 . As per claim 1 1 the combination of Belfiore and Ginter discloses a 
system/method as applied to claims above. Furthermore Belfiore 
discloses the method /system wherein the at least one aggregate 
/journal event is detected as a suspect action with a data file, [column 
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23, lines 64-column 24, lines 22 and column 21, lines 4-12 and column 
20, lines 57-67] 

12. As per claim 12 the combination of Belfiore and Ginter discloses a 
system/method as applied to claims above. Furthermore Belfiore 
discloses the method /system wherein the at least one aggregate event 
is attributable to a known/ end user, a thread and /or an application as 
identified at a known time, [figure 5, see "Time"] 

13. As per claim 13 the combination of Belfiore and Ginter discloses a 
system/method as applied to claims above. Furthermore Belfiore 
discloses the method /system wherein the coalescer reports a single 
coalesced event after a time out period with no activity, [column 24, lines 
21-22, "notify me if there is no mouse movement and no key is pressed in 
5 minutes") 

14. As per claims 14-15 the combination of Belfiore and Ginter discloses 
a system/ method as applied to claims above. Furthermore Belfiore 
discloses the method/ system wherein aggregate events are used to 
control security of the data processing system by determining 
patterns of unexpected behavior based on the at least one aggregate 
event and the audit trail, [column 21, lines 50-53 and column 23, lines 
64-column 24, lines 22 and column 21, lines 4-12 and column 20, lines 
57-67, See also the following which is disclosed by Ginter on column 65, 
lines 4-34. "FIG. 35 shows an example overall usage clearing process. In 
this example, a provider 164 provides a digital property to consumers 
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95(1), 95(2), 95(3). For example, provider 164 might provide a novel or 
other work 1 66 to each of the consumers 95 within electronic containers 
152. One or more control sets 188 may be associated with the work 166 
(and may, in one example, be delivered within the same electronic 
container 152 used to deliver the work 166). The controls 188 may specify 
that certain types of usage information must be gathered in the form of an 
audit trail and that the audit trail must be reported based on certain time 
and/ or other events . Because container 152 can only be opened within a 
secure protected processing environment 154 that is part of the virtual 
distribution environment described in the above-referenced Ginter et al. 
patent disclosure, provider 1 64 can be confident that the required audit 
trails will be generated and reported as he or she instructs. As consumers 
95 use the property 166, their electronic appliances 100 automatically 
gather and store the usage information in the form of audit trails 302. 
Then, upon the occurrence of a specified event (e.g., once a month, once a 
week, after a certain number of uses, etc.), the consumer electronic 
appliances 100 send audit trail information 302 within digital containers to 
usage clearinghouse 300. Usage clearinghouse 300 collects the audit trail 
information 302, may store it in its database 316, and analyzes the audit 
trail information to generate a report 304 which it may send to 
provider 164 within a further electronic container 152.") 

Conclusion 



15. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension 
of time policy as set forth in 37 CFR 1.136(a). 
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A shortened statutory period for reply to this final action is set to expire 
THREE MONTHS from the mailing date of this action. In the event a first 
reply is filed within TWO MONTHS of the mailing date of this final action 
and the advisory action is not mailed until after the end of the THREE- 
MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension 
fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date 
of the advisory action. In no event, however, will the statutory period for 
reply expire later than SIX MONTHS from the mailing date of this final 
action. 

Any inquiry concerning this communication or earlier communications 
from the examiner should be directed to Samson B Lemma whose 
telephone number is 571-272-3806. The examiner can normally be 
reached on Monday-Friday (8:00 am— 4: 30 pm). 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, BARRON JR GILBERTO can be reached on 57 1 - 
272-3799. The fax phone number for the organization where this 
application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status 
information for published applications may be obtained from either 
Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more 
information about the PAIR system, see http://pair-direct.uspto.gov. 
Should you have questions on access to the Private PAIR system, contact 
the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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/Samson B Lemma/ 
Examiner, Art Unit 2132 

/Gilberto Barron Jr/ 

Supervisory Patent Examiner, Art Unit 2132 



